CVE-2017-0379: gnupg/libgcrypt could expose secret keys

Versions of libgcrypt older than 1.8.1 have a weakness when using the Curve25519 encryption method that can allow an attacker to figure out a private key. This could let someone decrypt communications or forge signatures. Upgrade libgcrypt (and the Debian packages that include it) to the latest version to protect against this risk.

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.securityfocus.com/bid/100503 Third Party Advisory VDB Entry
• http://www.securitytracker.com/id/1041294
• https://bugs.debian.org/873383 Issue Tracking Third Party Advisory
• https://eprint.iacr.org/2017/806 Mailing List Third Party Advisory
• https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=da780c81...
• https://lists.debian.org/debian-security-announce/2017/msg00221.html Mailing List Patch Third Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-0379 Patch Third Party Advisory
• https://security.netapp.com/advisory/ntap-20180726-0002/
• https://www.debian.org/security/2017/dsa-3959 Patch Third Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html